IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Microsoft Build Engine Started an Unusual Process
editMicrosoft Build Engine Started an Unusual Process
editAn instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.
Rule type: eql
Rule indices:
- winlogbeat-*
- logs-endpoint.events.*
- logs-windows.*
- endgame-*
Severity: low
Risk score: 21
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Domain: Endpoint
- OS: Windows
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Data Source: Elastic Endgame
Version: 105
Rule authors:
- Elastic
Rule license: Elastic License v2
Investigation guide
editRule query
editprocess where host.os.type == "windows" and event.type == "start" and process.parent.name : "MSBuild.exe" and process.name : ("csc.exe", "iexplore.exe", "powershell.exe")
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Obfuscated Files or Information
- ID: T1027
- Reference URL: https://attack.mitre.org/techniques/T1027/
-
Sub-technique:
- Name: Compile After Delivery
- ID: T1027.004
- Reference URL: https://attack.mitre.org/techniques/T1027/004/